Apparatus and methods for causing privacy-sensitive direction of advertising messages based on prevalence of a healthcare condition in a plurality of geographic areas

ABSTRACT

A computer system and method causes selection of an advertisement based on the prevalence of a healthcare condition in each of a plurality of geographic areas. The prevalence is calculated by an entity that matches healthcare data with consumer data to determine, in each of the geographic areas, how many individuals have an unidentified healthcare condition. The entity removes information pertaining to specific geographic areas and healthcare condition codes that would permit re-identification of persons coded with those specific codes, so that the privacy of the personal healthcare information is maintained.

CROSS REFERENCE TO RELATED APPLICATIONS

This application is a continuation of application Ser. No. 14/496,467,filed Sep. 25, 2014, now U.S. Pat. No. 10,262,761, which is acontinuation of application Ser. No. 12/651,416, filed Dec. 31, 2009,now abandoned, which claims benefit of provisional application Ser. No.61/142,217, filed Jan. 1, 2009, provisional application Ser. No.61/142,315, filed Jan. 2, 2009, and provisional application Ser. No.61/244,565, filed Sep. 22, 2009, which provisional applications arehereby incorporated by reference as if fully set forth herein.

BRIEF DESCRIPTION OF THE DRAWINGS

FIG. 1 shows a diagrammatic view illustrating a geographical map showingprobability of a specified health condition across geographicallocations and associated demographic information, according to anembodiment.

FIG. 2 shows a use case diagram illustrating functions of an embodimentthat combines health condition information with consumer demographicinformation while statistically insuring that the identity ofindividuals cannot be known.

FIGS. 3A-3D show a data flow diagram illustrating an embodimentinvolving transfer of data between healthcare database entities andconsumer database entities while removing the information capable ofidentifying an individual.

FIG. 4 shows a class diagram illustrating the relationships amonghealthcare database objects, consumer database objects, and otherexample objects, including examples of attributes, according to anembodiment.

FIGS. 5A-5C show data structure layouts illustrating example values ofdata transmitted between the consumer household database and thehealthcare database, according to an embodiment.

FIG. 6 shows a network architecture diagram illustrating a computersystem configured to perform the steps of securely transferringinformation by secure physical delivery or by secure transmission overan insecure network, according to an embodiment.

FIGS. 7A and 7B show data structure layouts illustrating example valuesof electronic lists for automatically transmitting messages togeographical areas corresponding to selected health conditions anddemographic conditions, according to an embodiment.

FIG. 8 shows a system architecture diagram illustrating various computersystems for distributing documents and messages to target specificgeographic locations with a propensity for a specific health conditionand specific demographic profile, according to an embodiment.

FIGS. 9A-9C show a data flow diagram illustrating a series of steps tomeasure the effect of an online advertising campaign, according to anembodiment.

FIGS. 9D and 9E show a data flow diagram illustrating a series of stepsto measure the effect of an online advertising campaign using Zip+4codes, according to another embodiment.

FIG. 10A shows a class diagram illustrating the relationships amonghealthcare database objects, consumer database objects, onlineadvertising database objects, and other example objects, according to anembodiment.

FIG. 10B shows a class diagram illustrating the relationships amonghealthcare database objects, consumer database objects, onlineadvertising database objects, and other example objects, according to anembodiment.

FIGS. 11A-11C show data structure layout diagrams illustrating examplevalues of electronic lists for tracking information helpful indetermining an outcome of a healthcare advertisement, according to anembodiment.

FIG. 12 shows a network architecture diagram illustrating a computersystem configured to determine the effectiveness of online advertising,according to an embodiment.

DETAILED DESCRIPTION

In the following description, numerous specific details are set forthillustrating the inventor's best mode for practicing the disclosedsystems and enabling one of ordinary skill in the art to make and usethem. It will be obvious, however, to one skilled in the art that thedisclosed systems may be practiced without many of these specificdetails. In other instances, well-known software systems, softwaremethods, business methods, statistical methods, and other method stepshave not been described in particular detail in order to avoidunnecessarily obscuring this disclosure.

FIG. 1 shows a diagrammatic view illustrating geographical map 100showing probability of a specified health condition across geographicallocations and associated demographic information, according to anembodiment. Geographical map 100 shows the relationship between a healthcondition, consumer demographic data, and geographical location.Geographical map 100 contains stippling patterns to indicate thatcertain geographical regions are statistically likely to have aspecified concentration of people who experience a specified healthcondition and have a specified demographic profile. For example, a querycould be formed to determine geographical areas in which a minimum of20% of the individuals or households have received a diagnosis ofarthritis, have been prescribed non-steroidal anti-inflammatory drugs,and regularly clip coupons.

By way of example, the map has been shaded to show geographical areaswhere those conditions have been met. Top-level map 102 may show broadgeographic areas that meet those conditions. Sub-region map 104 may showcounties, cities, or other relatively large geographical subdivisionsthat meet those conditions. Street-level map 108 may show city blocks,Zip+4 areas, or even specific buildings (that have sufficiently largenumbers of individuals or households) where those conditions have beenmet. An embodiment may determine whether those conditions have been metby compiling health condition and demographic data in such a way thatthe data may not be later used to determine that a specific individualhas the health condition, thereby preserving the confidentiality of thehealthcare data and the privacy of the individuals who live in thegeographic area. For example, area 110 (which may correspond to a Zip+4area, proper name of a geographical subdivision, area defined bylatitude and longitude boundaries, etc.) shows no likelihood of thecondition in this area, hence it is not stippled. For example, area 112shows a higher probability of the condition, as seen by the lightstippling pattern. For example, area 114 of street-level map 108 showsthe highest probability of the condition, as seen by the dark stipplingpattern. FIG. 1 displays the information graphically, but theinformation may be used electronically by embodiments to automaticallyor manually send messages to the residents of the geographic area. Thisinformation may also be used for research purposes.

FIG. 2 shows a use case diagram illustrating functions of an embodiment(system 200) that combines health condition information with consumerdemographic information while statistically ensuring that the identityof individuals cannot be known. System 200 may be acted on by user 202,consumer-database 204, and healthcare-database 206. User 202 may invokefunction select-health-condition 208 to indicate to system 200 that user202 would like a list of geographical areas with a specifiedconcentration of the health condition. The health condition may be anyindicator of health, such as an ailment, a disease diagnosis, acondition related to health, details regarding insurance coverage, otherinformation subject to regulation as personal health information. System200 may next be acted on by consumer-database 204, whereconsumer-database 204 may activate function generate-keys 210. Functiongenerate-keys 210 may use de-identification software that may sometimesbe provided by healthcare-database 206 to generate keys corresponding tothe individual consumers or households that are stored inconsumer-database 204. Function generate-keys 210 may transmit the keysand a token of consumer information (for example, any or all of thename, address, phone number, Social Security number) tohealthcare-database 206.

Healthcare-database 206 may invoke function correlate-keys-to-data 212,which may use the token of consumer information to attempt to match thekey to the patient data in healthcare-database 206. Healthcare-database206 may invoke function query-health-condition 214, which may use thehealth-condition preferences of user 202 to identify records inhealthcare-database 206 that exhibit the specified health condition toanswer the query of user 202. Healthcare-database 206 may invokefunction sub-set-and-falsify 216, which may sub-set the answer to thequery to remove data without statistically altering the outcome of theanswer to the query of any given geographic region. Functionsub-set-and-falsify 216 may also falsify a statistically insignificantamount of data in the answer to the query. Functionsub-set-and-qualified (not shown) may take further actions to introduceuncertainty as to the probability of the health condition applying toany specific individual without statistically altering the answer to thequery for any given geographic region.

Healthcare-database 206 may invoke functionmatch-keys-and-health-expression 218, which may transmit the answer tothe query (without any personally identifying information) and theassociated keys to consumer-database 204. The answer to the query may beexpressed as the key and an obscured expression of the health condition,which may be referred to as the health-expression herein. (See also FIG.5B.) Consumer-database 204 may match the keys received in the answerfrom healthcare-database 206 to the keys stored in consumer-database 204that were generated by function generate-keys 210. Consumer-database 204may invoke function destroy-ID-info 220 to destroy the keys, consumertokens, and any information or process used to help match the datareceived from healthcare-database 206 to the data in consumer-database204. After destruction of this data, healthcare-database 206, usingfunction un-obscure-health-condition 222, may transmit a map between thehealth-expression and the actual, descriptive health condition, whichmay be used by consumer-database 204. Consumer-database 204 may invokefunction query-by-geography-and-consumer-demographics 224 to determinean answer needed to respond to a query from user 202 involving thepreviously selected health condition, geographic location, and otherdemographic data stored in consumer-database 204.

FIGS. 3A-3D show a data flow diagram illustrating the operation of anembodiment (system 300) involving transfer of data betweenhealthcare-data entity 304 and consumer-data entity 302 while removingthe information capable of identifying an individual. Note that thesingle lettered circles indicate connections between figures, and FIGS.3A to 3D are considered together in the following text.

System 300 has a series of steps that may be performed by consumer-dataentity 302 and healthcare-data entity 304, as shown in FIG. 3A. The term“entity” as used herein means a company, organization, or other entitythat holds information such as a consumer or healthcare database. System300 may begin by consumer database entity 302 performing the stepgenerate-keys 308, which may query information from consumer database306. Step generate-keys at 308 may use de-identification software tocreate a unique key for each record in consumer database 306.De-identification software may be any type of personal-informationredactor or proxy system, such as, commercial de-identification softwarelicensable from MedQuist or D-Id Data Corp. Step generate-keys 308 maystore the key and a token of the consumer information intokeys-and-consumer-tokens database 312.

Healthcare-data entity 304 may receive keys-and-consumer-tokens database312 from consumer-data entity 302 and may perform step correlate-keys314 using information from healthcare database 322. Step correlate-keys314 may use the consumer information, such as name, address, phone,Social Security number, and other information that may identify aconsumer, to match the keys in keys-and-consumer-tokens database 312 tothe data for consumers stored in healthcare database 322; that is, stepcorrelate-keys 314 tries to find the same person whose data is containedin consumer database 306 and match that person's data to correspondingdata in healthcare database 322. The keys allow an association betweenthe demographic information in consumer database 306 and thepatient/healthcare information stored in healthcare database 322.However, because neither entity has physical, electronic, or any otheraccess to the information of the other entity, additional regulatoryrequirements may not have been imposed upon either entity. That step mayintroduce additional risk of re-identification; consumer-data entity 302may desire to mitigate that risk through statistically analyzing system300 (including the process, steps, and data used therein) to recertifyunder such regulatory requirements. The references herein to regulatoryrequirements refer to any applicable governmental regulation, such asthe Health Insurance Portability and Accountability Act (“HIPAA”) orother requirements.

Step destroy-generation-info 316 may destroy thekeys-and-consumer-tokens database 312 after transmittingkeys-and-consumer-tokens database 312 to healthcare-data entity 304, sothat only healthcare-data entity 304 has information relating the keysto the consumer tokens. Consumer-data entity 302 may retain only thekeys in association with consumer database 306. Healthcare-data entity304 may destroy keys-and-consumer-tokens database 312 after transmittingit to obscure-health-expression database 326 (see below). Electronicdata destruction may be made irreversible by a variety of securemethods, such as physical or magnetic construction of electronic mediaor multiple rewriting of random data over electronic media.

Consumer-data entity 302 may perform step certify-destruction 318 bysending certificate-or-guarantee information 320 to healthcare-dataentity 304, which will receive this information by stepreceive-certificate 321. Step certify-destruction 318 may requireconsumer-data entity 302 to take reasonable security measures to ensurethat the appropriate information is destroyed, such as creating thekey-and-consumer-tokens database 312 on computers physically andelectronically separated from other networks or computers ofconsumer-data entity 302 or requiring that employees who perform theseprocedures or have access to the keys-and-consumer-tokens database 312contractually, ethically, or otherwise promise to destroy theinformation or to keep the contents confidential from third-parties.These steps may or may not be required by law. These steps may berequired by healthcare-data entity 304 or HIPAA statistician-or-auditor360 because those entities may require the certification to performother steps in the system such as step certify-process 358 (see FIG.3D).

With reference to FIG. 3B, healthcare-data entity 304 may perform stepquery-health-condition 324. Step query-health-condition 324 may read thedata from healthcare database 322 to determine the answer to a queryregarding a specific health condition. Step query-health-condition 324may begin storing this information in obscure-health-expression database326 for eventual transmittal to consumer-data entity 302. The datastored in obscure-health-expression database 326 may be obscured so thatconsumer-data entity 302 may not learn the health condition of theindividuals associated with the keys.

Step falsify-data 328 may add additional records toobscure-health-expression database 326, to create a statisticallyinsignificant ambiguity in the data transmitted to consumer-data entity302. By creating a statistically insignificant ambiguity, the usefulnessof the data transmitted to consumer-data entity 302 is not diminished,because consumer-data entity 302 may use this data to determine onlygeographical regions that are suitable for targeting a message and notcare to identify health concerns of specific individuals. That is, byintroducing false information, even if someone attempted to re-identifythe data transmitted to consumer-data entity 302, the result of thatattempt would be suspect because false records would have beenintroduced. This may reduce the usefulness of the data transmitted toconsumer-data entity 302 for determining health-condition of aparticular individual. Alternatively, some geographical regions may befalsely selected or sub-settled to introduce further uncertainty in anyeffort by a third-part to re-identify the data, and such a situation maybe acceptable because of the non-medical use of the data to transmitmessages.

Healthcare-data entity 304 may perform step sub-set 332. Step sub-set332 may remove records from obscure-health-expression database 326 tocreate a statistically insignificant ambiguity in the data transmittedto consumer-data entity 302. By creating a statistically insignificantambiguity, the usefulness of the data transmitted to consumer-dataentity 302 is not diminished, because consumer-data entity 302 may usethe data to determine geographical regions and not care to identifyhealth concerns of specific individuals. That is, by removing records,even if someone attempted to re-identify the data transmitted toconsumer-data entity 302, the result of that attempt would be suspectbecause not all records would have been used. This may reduce theusefulness of the data transmitted to consumer-data entity 302 fordetermining health-condition of a particular individual.

Healthcare-data entity 304 may perform step test-boundary-condition 333.Step test-boundary-condition 333 may determine when a geographic regionmay exhibit characteristics that would allow consumer-data entity 302,or a third-party, to determine the health condition of an individual Forexample, if the health condition is arthritis and a particular Zip+4postal code contained only a senior living facility where nearly all ofthe residents had arthritis, then the data transmitted to consumer-dataentity 302 might be used to determine that a particular individual (allof the individuals) had the health condition of a diagnosis ofarthritis. Likewise, for example, if a particular Zip+4 postal codecontained only one African-American household, and the health conditionis sickle cell anemia, the data transmitted to consumer-data entity 302might be used to determine that that particular household contained anindividual with sickle cell anemia. Under boundary conditions, where avery small number of individuals in a geographical region or all oralmost all individuals in a geographical region exhibit the specifiedhealth condition, step test-boundary-condition 333 may exclude any datafrom a geographical region. Alternatively, the cooperation of theconsumer-data entity 302 may be necessary to test and identify certainboundary conditions. Alternatively, certain querying of highly specifichealth conditions may not be permitted if such a query was likely toidentify populations highly likely to exhibit boundary conditions.

Consumer-data entity 302 may perform the step of match-keys 334, byreading the information from consumer database 306 and using the keys tomatch the data in obscure-health-expression database 326 to eachindividual consumer's data in consumer database 306. Step match-keys 334may store the health-expression, the keys, and the consumer data in aphysically separated, electronically separated, or otherwise securelylocated system away from identifiable data or unauthorized employees tolater aid step certify-destruction 342 (see FIG. 3C).

Consumer-data entity 302 may perform the step de-identify-info 336 byreading the consumer database 306 and writing geographical regioninformation (such as a Zip+4 postal code), desired demographicinformation, the health-expression, and an aggregation of the number ofconsumers that indicate the health-expression into the temporarydatabase 338, as shown in FIG. 3C. Temporary database 338 may be storedphysically separated, electronically separated, or otherwise be securelylocated away from other data or unauthorized employees to later aid stepcertify-destruction 342.

Consumer-data entity 302 may perform step destroy-keys-and-matching-info340 by destroying all traces of the keys, the process, temporaryinformation, or any other physical or electronic records that may beable to link (or otherwise aid in the re-identification of) theinformation in the geo-health database 354 to the consumer database 306.Consumer-data entity 304 may perform the step of certify-destruction 342by transmitting certification-or-guarantee information 344 tohealthcare-data entity 304, which may receive the information by stepreceive-certificate 346. Similar to step 318, information 320, and step321, these steps may be performed similarly to achieve similarobjectives.

Healthcare-data entity 304, after being satisfied by the receipt ofcertificate-or-guarantee information 344, may perform steptransmit-health-condition 348, as shown in FIG. 3D. Steptransmit-health-condition 348 may write health-condition-map database350, which may contain the health-expression and an indicator of theactual, descriptive health condition, so that the health-expression maybe understood. Consumer-data entity 302 may perform the step ofun-obscure-health-expression 352 by reading the transmittedhealth-condition-map 350 and associating the health-expression with theactual health condition. Step un-obscure-health-expression 352 may writeto the geo-health database 354, which may contain a geographicalindicator (for example, a Zip+4 postal code), demographic data, thehealth condition, and an indicator of the approximate quantity ofindividuals or households that exhibit the health condition.

Consumer-data entity 302 may perform step query 356 by queryinginformation in the geo-health database 354 by using query parameterssuch as demographic profile information, geographical location, or aminimum quantity of households.

Healthcare-data entity 304 may perform the step certify-process 358 byallowing HIPAA statistician-auditor 360 to audit or to statisticallyascertain that system 300 complies with governmental regulations thatrequire privacy of individual's personal health information, such asHIPAA. System 300 may further allow compliance with other types ofregulations, such as compliance with company privacy policy (which maybe stricter than governmental regulation), or other laws. System 300 maybe statistically certifiable as compliant with government regulationsrestricting the use of personal health information (for example, HIPAA)because: healthcare-data entity 304 never has access to the data ofconsumer-data entity 302 and consumer-data entity 302 never has accessto the data of healthcare-data entity 304 (except the health-expression,which is meaningless before step un-obscure-health-expression 352 isperformed), or consumer-data entity 302 may not know the meaning of thehealth expression whenever it is working with identifiable data.Further, limiting the quantity of data sent (for example, using atwo-valued health-expression as discussed in FIGS. 5B and 5C) andobscuring the description of the health condition may further assist thestatistical process of certification for compliance with lawsrestricting the use of personally identifiable health information.

Upon reading the teachings of this specification, those with ordinaryskill in the art will realize that, under appropriate circumstances,considering such issues as technology preference, system architecture,security, economic considerations, advances in technology, and userpreference, other types of databases, such as flat files, XML, HTML, CSVfiles, database exports, text files, EDI, or other file types, and othertransmission protocols, may suffice.

FIG. 4 shows a class diagram illustrating the relationships betweenhealthcare database objects and consumer database objects and otherexample objects, including examples of attributes, according to anembodiment.

System 400 shows objects and their relationships to each other. Objectconsumer-household 402 shows some example attributes that may be storedfor consumer household postal information by a consumer-data entity.Object consumer-household 402 may contain information related tocontacting or identifying the consumer such as name, address, Zip+4,phone number, e-mail address, and Social Security number. Objectconsumer-household 402 may contain information obtained during the U.S.Census such as employment, age, gender, presence of children, ethnicity,household income, education, and hobbies. Object consumer-household 402may contain information from credit reporting agencies such as Equifax,TransUnion, or Experian. Object consumer-household 402 may containinformation from consumer surveys (for example, self-reported consumersurveys) such as MRI, Simmons' Attributes, media preferences, hobbiesand interests, coupon usage, pharmacy redemptions, OTC usage, healthattitudes, health product usage, tobacco usage, medical device usage,mobile plans, and credit card data. Object consumer-household 402 maycontain only information that may not be subject to governmentalregulation because the information would not be considered personalhealth information.

Object consumer-household 402 may be related to object keys-and-tokens406 because object consumer-household 402 may be de-identified to createthe object keys-and-tokens 406. Object consumer-household 402 may berelated to object geo-health 410 because object consumer-household 402may be de-identified to create the object geo-health 410.

Object healthcare 404 shows some example attributes that may be storedfor a patient by a healthcare-data entity. Object healthcare 404 maycontain information used to identify the patient such as patient name,address, phone, and Social Security number Object healthcare 404 maycontain personally identifiable health information that usually is thesubject of governmental regulation (for example, HIPAA). Objecthealthcare 404 may contain information used to record medical treatmentsor medical billing such as disease diagnosis, prescription drug usage,medical compliance, insurance coverage, insurance co-pay tiers, andother ailment data Object healthcare 404 may be related to objectobscure-health-expression 408 because object healthcare 404 may extracta portion of its information and obscure that information to createobject obscure-health-expression 408. Object healthcare 404 may berelated to object health-condition-map 412 because object healthcare 404may generate for later transmission object health-condition-map 412whenever object obscure-health-expression 408 is generated. Objectobscure-health-expression 408 may contain aggregated, de-identifiedhealth insurance claims from pharmacies, physicians, hospitals,insurers, or other medical providers.

Object keys-and-tokens 406 may contain information used to relate aconsumer's demographic data to the consumer's healthcare data using aunique and non-identifying key. Object keys-and-tokens 406 may containtokens of information useful or helpful to ensure that the same consumeris identified in object consumer-household 402 and object healthcare404. In an alternate embodiment, the tokens of information may not besupplied; rather, the same software may be used by the healthcare-dataentity and the consumer-data entity, and that de-identification softwaremay be designed to always generate the same key given similar consumeridentification information. Exact mapping between consumers in objectconsumer-household 402 and object healthcare 404 may not be required toeffectively model the geographical areas that are subject to the healthcondition or other term of the query. Object keys-and-tokens 406 may berelated to object healthcare 404 because the keys or tokens of objectkeys-and-tokens 406 may be used to correlate with object healthcare 404.

Object obscure-health-expression 408 may contain information andattributes used to create object geo-health 410 by de-identifyingconsumer-household 402, as shown. Object obscure-health-expression 408may contain the unique key and a health-expression. Eachhealth-expression may be two valued, such as “yes” or “no”, zero (0) orone (1), or “T” or “F”. Limiting the amount of information that isencoded in health-expression reduces the risk that the consumer-dataentity or a third party may be able to re-identify the data.

Object geo-health 410 may contain information or attributes that relatethe demographic information from object consumer-household 402 to ageographic identifier, such as Zip+4, and to the health-expression, andlater, to the health condition. Object health-condition-map 412 maycontain information and attributes used to map the obscurehealth-expression to the actual health condition. Objecthealth-condition-map 412 may contain two attributes that describe thetwo values of the health-expression.

Upon reading the teachings of this specification, those with ordinaryskill in the art will realize that, under appropriate circumstances,considering such issues as security, encryption, governmentalregulations, economic considerations, advances in technology, and userpreference, other types of obscuring or health-expressions, such asthree-valued, multi-valued, or encrypted health-expressions, or othermethods of obfuscation or obscuring health conditions, may suffice.

FIGS. 5A-5C show data structure layouts illustrating example values ofdata transmitted between the consumer household database and thehealthcare database, according to an embodiment.

FIG. 5A shows a table illustrating a data structure layout for akeys-and-tokens data file (such as object keys-and-tokens 406). Thecolumns include the unique key, the name, the address, the phone number,and the Social Security number. Alternatively, other kinds ofidentifying information could be used such as e-mail addresses, faxnumbers, previous addresses, or employment records. The key may beuniquely generated. The key may be random or sequential. The key may notembody, encrypt, or otherwise identify the consumer.

FIG. 5B shows a table illustrating a data structure layout for anobscure-health-expression data file (such as objectobscure-health-expression 408). The columns include the key and thehealth-expression. In this embodiment, the key is uniquely generated andrelates to FIG. 5A. The health-expression may be zero or one.

FIG. 5C shows a table illustrating a data structure layout for ahealth-condition map data file (such as object health-condition-map412). The columns include the health condition and thehealth-expression. In this example, the health-expression indicated by“0” is mapped to the health-condition description “positive forarthritis and NSAID treatment.” In this example, the health-expressionindicated by “1” is mapped to the health-condition description “negativefor arthritis and NSAID treatment.” As discussed above, other methods ofobscuring the health condition may be used.

FIG. 6 shows a network architecture diagram illustrating computer system600 configured to perform the steps of securely transferring informationby an insecure network (by encryption or secure channel) or securephysical delivery according to an embodiment. System 600 includesconsumer-data entity 604 and healthcare-data entity 605. Consumer-dataentity 604 may store consumer household demographic data on consumerhousehold postal database 606. Consumer-data entity 604 may generatekeys and tokens for transmittal to healthcare-data entity 605.Consumer-data entity 604 may use secure geo-health database 610 tocreate keys and tokens, which may be physically or electronicallysecured or otherwise separated from consumer-data postal database 606 bysecurity-measures 608. Security-measures 608 may include networkfirewalls, security systems, security cameras, nondisclosure agreements,and other protective measures to ensure that the information stored ongeo-health database 610 remains confidential and is not transmitted tounauthorized third parties. Security-measures 608 may include adedicated computing platform (that is, physically and or electronicallyseparated from other systems), on-site security, software destructionprograms, preventing access by third parties, etc.

After generation of keys and tokens, consumer-data entity 604 maytransmit the keys and tokens to healthcare-data entity 605 over aninsecure network, such as the Internet 612 (or other global or computernetwork). Consumer-data entity 604 may transmit the keys and tokensusing an encrypted or otherwise secure channel such as secure socketlayer, SFTP, FTPS, SSH, SCP, or virtual private network (VPN).Healthcare-data entity 605 receives the keys and tokens into healthcaredatabase 616 through security measures 614. Alternatively, data may betransmitted using a secure private line or private network or similarprivate connection.

Alternatively, consumer-data and the 604 may transmit the keys andtokens to healthcare-data entity 605 using physical media such as tape(capable of recording electrical signals), or a CD-ROM. The physicalmedia may be transmitted by courier 618. Ultimately, other methods oftransmitting the data without revealing the contents of the key andtoken information to third parties may be used.

FIGS. 7A and 7B show data structure layouts illustrating example valuesof data files to identify consumers or geographical areas toautomatically transmit messages that correspond to selected healthconditions and selected demographic conditions, according to anembodiment.

FIG. 7A shows a table illustrating a data structure layout for a list ofconsumers that live in a geographical area specified by a queryincluding a selected health condition and a selected demographiccondition. This table may contain personal information, such as mailingaddresses, phone numbers, or e-mail addresses, which may be used toautomatically contact the individuals or households.

FIG. 7B shows a table illustrating a data structure layout for a list ofgeographical areas that were specified by a query including a selectedhealth condition and a selected demographic condition. This table maycontain Zip+4 information and a percentage of the individuals andhouseholds that exhibit a selected demographic condition and selectedhealth condition. This table may also contain Internet protocol (“IP”)address ranges that are typically assigned to a geographical area. TheZip+4 information may be used for direct mail, email, addressableadvertising by cable TV operators or by magazine and newspaperpublishers, and any other type of addressable messaging. The IP addressranges may be used for targeted online messages. This table may alsocontain latitude and longitude locations that directly indicate thegeographical area that may be used when GPS information is available tothe automated message delivery system. Alternatively, a simple list ofZip+4 codes that meet the selected demographic condition and selectedhealth condition may be provided to further ensure the privacy andirreversibility of the healthcare information used to generate thisdata. Alternatively, a list using geographic proper names, such ascities, towns, subdivisions, or streets, may be used to determinegeographic areas that meet the selected health condition and demographicprofile.

FIG. 8 shows a system architecture diagram illustrating variousautomated systems for distributing documents and automated messages totarget specific geographic locations with a propensity for a specifichealth condition and a specific demographic profile, according to anembodiment.

Automated delivery systems 800 may include methods to transmit message802 to consumer 804. Automated delivery systems 800 include deliverymethods such as postal delivery 806, computer network 810, telephonenetwork 816, and television network 822.

Postal delivery 806 may transmit message 802 by various mail pieces 808.Mail pieces 808 may include direct mail for delivery to the geographicareas (list of ZIP+4) that correspond to a specified health conditionand specified demographic profile. Mail pieces 808 may be directed bysegmenting a portion of all copies of a nationally distributedpublication, requesting a printing of those copies including withmessage 802 included, and delivering those copies to the geographicareas (list of Zip+4 areas) that correspond to a specified healthcondition and specified demographic profile.

Computer network 810 may transmit message 802 by methods including usingthe geographic area (for example, the Zip+4) and an IP address or emailaddress (which may be used by mapping the IP or email address to a Zip+4or to the geographic area directly). Computer network 810 may facilitatetransmittal for cost per click (“CPC”) or pay per click (“PPC”)advertising by using either Zip+4 lists, IP address lists, or emailaddress lists; the list may be selected based on economicconsiderations, technological advances, or other factors concerning thetargeted delivery of message 802. Computer network 810 may transmitmessages to computer 812, which may display CPC, PPC, banneradvertising, or other Internet- or network-based advertising capable ofdistinguishing what message to display based on email, IP, networkaddress, or other online identifier. Computer network 810 may delivermessages to handheld device 814. Handheld device 814 may be a mobilephone or personal data assistant (“PDA”) capable of transmittinginformation over computer network 810. Handheld device 814 may becapable of transmitting the GPS location (that is, the latitude andlongitude) of the individual. Computer network 810 may use the GPSlocation to determine if message 802 should be sent to handheld device814. Computer network 810 may be able to transmit message 802 tohandheld device 814 using voice over IP (“VOIP”) protocol, when message802 is a prerecorded audio message. Computer network 810 may be able totransmit message 802 to computer 812 and handheld device 814 as ane-mail message.

Telephone network 816 may transmit message 802 to telephone 818 andhandheld device 814 (when handheld device 814 is a mobile phone or otherdevice capable of receiving information via telephone network 816),whenever message 802 is a prerecorded audio message, such as by using anautomated dialer. Telephone network 816 may transmit SMS text messagesto mobile phones (that may be owned by individuals living in a selectedgeographic area), which messages allow the user to respond and listen toa prerecorded message. Telephone network 816 may transmit message 802 tofax machine 820, whenever message 802 is an electronic fax transmission.

Television network 822 may transmit message 802 to television 824,whenever message 802 may be targeted to a specific geographic area andmay be within the cable operator's jurisdiction. For example, cabletelevision operators can transmit different television signals todifferent geographic locations on the same channel. This may allowmessage 802 to be delivered only to geographic areas that have a highcorrespondence to the specified health condition and specifieddemographic information. Television network 822 may transmit message 802to consumer 804 using addressable TV technology, such as digital cableTV.

Upon reading the teachings of this specification, those with ordinaryskill in the art will realize that, under appropriate circumstances,considering such issues as technology preference, system architecture,delivery method, media, message content, economic considerations,advances in technology, and user preference, other types of automatedmessages, such as radio commercials, television commercials, textmessages, instant messages, SMS messages, and social networkingadvertising, other transmission protocols, and other ad campaigntechniques, such as opt-in/opt-out email, opt-in/opt-out direct mail,consumer publications, local newspapers, consumer portals, cell phonebrowsers, direct response TV, clinical trial patient recruiting, or CRMappends may suffice.

FIGS. 9A-9C show a data flow diagram illustrating a series of steps ofsystem 700 to measure the effect of an online advertising campaign,according to an embodiment. In this embodiment, the foregoing methodscan be applied to determine the effectiveness of online advertising, forexample by allowing calculation of a return on advertising investmentfor advertising programs that are disseminated online, typically througha globally connected network such as the Internet. Note that thesingle-lettered circles indicate connections between figures, and FIGS.9A-9Cc, which are considered together in the following discussion.

In embodiments that measure the impact of digital display advertising,medical record information, consumer information, and Internet Protocoladdress information are merged and evaluated to aid analysis of onlineadvertising. Analysis may include the effectiveness of the targeting ofthe online advertising, the relevance of the message used in the onlineadvertising, and whether the results of the online advertising may bestatically proven. The analysis may be used to vary future advertisingmedia mix, for example by using more or less online advertising incomparison to other media (TV, radio, print, etc.) The analysis may beused to compare various online campaigns to one another. The analysismay be used to determine if targeting specific consumers or healthcondition sufferers may achieve a specified performance level.Personally identifiable consumer data may be excluded from viewing oranalysis, which may allow HIPAA-certification of the process or entitiesby a statistician, who may be independent from the other entitiesdiscussed in FIG. 9 .

System 700 and may perform a series of steps by online ad data entity702, consumer-data entity 704, and healthcare data entity 720, as shownin FIG. 9A. System 700 may calculate a return on advertising investmentto help show what effect an online advertising campaign may have forproducts or services related to a treatment for an ailment. System 700may be able to calculate a return on advertising investment even afterthe conclusion of the online advertising campaign.

System 700 may begin with the online ad data entity 702 performing stepdisplay-ads 706. Step display-ads 706 may display advertisements thatmay be related to a particular treatment for an ailment. Stepdisplay-ads 706 may generally capture an online identifier to indicateto whom the advertisement was displayed, for example an advertisementmay be displayed to a particular Internet protocol address or sent to aparticular e-mail address. Step display-ads 706 may displayadvertisements by paying for inclusion in search engine results, forexample paid search. Step display-ads 706 may display advertisements onsocial media websites. Upon reading the teachings of the specification,those with ordinary skill in the art will realize that, underappropriate circumstances, considering such issues as technologypreference, system architecture, delivery method, advertising content,economic considerations, advances in technology, user preferences, andmedia, other types of online identifiers may suffice.

Step display-ads 706 may store the online identifier in the ad-outcomedatabase 708. Step display-ads 706 may also store the result or outcomeof the advertising display to the particular user, such as whether theuser only viewed the ad, whether the user clicked the ad, or whether theuser redeemed the ad. For the purpose of this specification, redeemingan advertisement means any action a user takes in response to anadvertisement that may be tracked by the online ad-data entity 702, suchas allowing the user to sign up for newsletter, allowing the user tosign up for additional information, providing the user with a coupon, orotherwise capturing information about the user. Step display-ads 706 maywrite a “cookie” to the web browser of the user to whom the ad isdisplayed, to track additional usage or repeated view by the same useror same web browser, which may allow tracking of progress through otherwebsites where the same web advertising server is used to display ads.The ad outcomes collected during the display of online advertising mayinclude IP addresses that were exposed to online advertising, the IPaddress that clicked through the online advertising, and IP addressesthat “opted-in,” converted, or redeemed the online advertising.

Ad-outcome database 708 may store any information about the displayingof advertisements. Ad-outcome database 708 may contain onlineadvertising outcomes for online advertisements related to a healthcondition that is a set of online-advertising-outcome data.

Consumer-data entity 704 may begin by correlating the ad-outcomedatabase 708 to the consumer database 712. To correlate the set ofonline advertising outcome data to the set of consumer data, the onlineidentifier may be used. To correlate the ad-outcome database 708 to theconsumer database 712, step correlate 710 may match information in thead-outcome database 708 to information in the consumer database 712. Inone embodiment, the correlated information may include the Internetprotocol address. In another embodiment, the correlated information mayinclude the e-mail address. When an advertisement is redeemed, otherinformation may be available to help correlate, such as first and lastnames, street addresses, telephone numbers, or additional e-mailaddresses. It may not be necessary to correlate every record ofad-outcome database 708 to a record in consumer database 712 because tocalculate a return on advertising investment with sufficient statisticalcertainty, not every record may be required. Step correlate 710 maystore the combination of the ad-outcome database 708 and the consumerdatabase 712 in ad-outcome and consumer database 714.

Consumer-data entity 704 may continue with step generate-keys 716, asshown in FIG. 9B. Step generate-keys 716 may be performed similarly tostep generate-keys 308 as discussed above in reference to FIG. 3A. Stepgenerate-keys 716 may use consumer database 712 to generate keys andconsumer tokens (for example, by de-identification, as previouslydiscussed in connection with FIG. 3A and elsewhere) for keys andconsumer tokens database 718. Cost may be a factor in selecting thedetails of the de-identification process; for example, de-identificationto determine a ZIP+4 may cost less than de-identification to determine aparticular individual or a particular household. Other steps in thede-identification process may be included as desired to protect theprivacy of the individuals, for example falsification of a portion ofthe healthcare claims database or selecting ZIP+4 level rather thanindividual or household level. Transmission of de-identified data,including keys and consumer tokens may be handled by securetransmission.

Healthcare-data entity 720 may use keys and consumer tokens database 718for step correlate keys 722 to correlate with healthcare database 724.Step correlate-keys 722 may be performed similarly to stepcorrelate-keys 314, as discussed above in reference to FIG. 3A.Healthcare-data entity 720 may continue with step query-health-condition726, as shown in FIG. 9C. Step query-health-condition 726 querieshealthcare database 724 for records related to the health condition orailment that is the subject matter of the online advertising. Stepquery-health-condition 726 may determine what treatment or change intreatment (or other change in healthcare information that may bequantified) occurred during the same time period as the onlineadvertising or can otherwise be linked to the display of the onlineadvertising. Healthcare claims data that matches the de-identifiedpatients or consumers may be found to determine what treatments (or newdiagnosis) may have been attributable to the display of the onlineadvertisement.

Step query-health-condition 726 may return records related to the keysand consumer tokens database 718 and records that are not related to thekeys and consumer tokens database 718 but are related to the healthcondition targeted by the online advertising. Stepquery-health-condition 726 may query healthcare database 724 using thehealth condition targeted by the online advertising to determinetreatments provided to patients. Step query-health-condition 726 mayquery healthcare database 724 to establish any relationship to theonline advertising outcome. In an embodiment, records related toconsumers viewing advertising may eventually form part of a test group,and records not related to consumers viewing advertising may form partof a control group. By comparing the test group to the control group,step query-health-condition 726 may determine variations in the quantityof treatment between the two groups, which may be statisticallyanalyzed. In another embodiment, only records related to consumersviewing advertising may be returned. Step query-health-condition 726 maysupply keys-and-treatments database 728 with treatment information fromhealth care database 724 in relation to the keys from keys and consumertokens database 718. In some embodiments, treatment information may besummarized by geographical region, such as the ZIP+4 area. In otherembodiments, treatment information may be grouped by online-identifier.

Treatment information may be quantized for analysis, for example bysumming the new prescription activity for a drug featured in an onlineadvertisement or summing the refill prescription activity for a drugfeatured in an online advertisement.

Consumer-data entity 704 may perform step correlate 730. Step correlate730 may associate keys-and-treatments database 728 withad-outcome-and-consumer database 732. This step allows association ofthe online-identifier with the summarized treatment information in thekeys-and-treatments database 728. This step may write toadd-outcomes-and-treatments database 734. As discussed previously, stepcorrelate 730 (or other steps as necessary) may include steps to destroyany information capable of identifying any individual (while retaininginformation that allows relationship to the IP address that is servingas a geographical location) whose healthcare information may be storedin healthcare database 724. As discussed previously, step correlate 730(or other steps as necessary) may include steps to certifying the stepof destroying, to guarantee that the consumer data may not be used toidentify the health-condition of any individual. As discussedpreviously, step correlate 730 (or other steps as necessary) may includecertification of the system by a statistical professional that thesystem complies with governmental regulation of personal healthcareinformation.

Consumer-data entity 704 may perform step measure effect 736. Stepmeasure effect 736 may calculate the return on investment foradvertising dollars by calculating the difference in treatment of thetest group that was exposed to the online advertising to the increase intreatment of the control group that was not exposed to the onlineadvertising. Statistically, both groups may be equally likely to beexposed to mass-media advertising, for example television commercials,radio commercials, or direct mail. By dividing the set of healthcaredata into at least two groups and comparing a group exposed to theonline advertising and a group not exposed to online advertising, theprocess may assist in determining the effectiveness of the onlineadvertising. In some embodiments, calculations may be done for a seriesof periods, for example week over week, month over month, or day overday. In some embodiments, calculations may compare periods before andafter online advertising. By dividing the groups by time periods andcomparing before and after the period of online advertising, the processmay determine the effectiveness of the online advertising. This mayallow step measure effect 736 to compare the amount spent on onlineadvertising to the difference between the amount of treatment for thegroup exposed and the amount of treatment for the group not exposed,which may allow a calculation of the return on investment.

In another embodiment, step measure effect 736 may instead compare theeffectiveness of one online advertising campaign with another onlineadvertising campaign in order to compare the relative effectiveness ofthe online advertising campaigns, for example to determine the mosteffective online advertising campaign. In this embodiment, the quantityof treatment arising after the first advertising campaign may becompared to the quantity of treatment arising after the secondadvertising campaign. The quantity of treatment may be adjustedproportional to the number of times that the advertisement wasdisplayed. For example, a quotient may be calculated of the totalquantity of treatment results for the first advertising campaign dividedby the total number of times the first advertisement was displayed. Thisquotient may be compared to the quotient of the second advertisingcampaign to allow comparisons of the effectiveness of one or moreadvertisements. In other embodiments, other types of return oninvestment calculations or measures of online advertising effectivenessmay be used. By dividing the groups by the level of interactivity withthe online advertising, the process may compare the treatment of thegroup viewed, to the treatment of the group clicked, to the treatment ofthe group redeemed, or to the treatment of the group not exposed, todetermine the effectiveness of the online advertising.

Step measure effect 736 may calculate other metrics that may be used toanalyze the effectiveness of online advertising, for example the rate ofclick-through rate and redemption for a specified medical diagnosis andtreatment or how many of the people who were exposed to, or who actuallyclicked or redeemed, an advertisement actually suffer from a specifiedmedical condition, comply with the prescription specified by theirphysician, or are insured (and, if so, the amount of any co-pay). Forexample, the system may allow comparing medication purchasing behavioramong groups of people who were exposed to, or who clicked or redeemed,an online advertisement before and after the online advertisingcampaign. The comparison may include or exclude geographical regionsbased on the geographical targeting of other media advertising.

FIGS. 9D and 9E show a data flow diagram illustrating a series of stepsof system 737 to measure the effect of an online advertising campaignusing Zip+4 codes, according to another embodiment. System 737 mayfollow substantially similar steps and data flow as System 700 (seeFIGS. 9A-9C), including the interaction between online-data entity 702and consumer-data entity 704. FIGS. 9D and 9E are connected by thesingle, circled letter A.

FIG. 9E shows system 737 correlating or tabulating information fromhealthcare-data entity 720 using different steps and data. To correlateor tabulate healthcare database 724, healthcare-data entity 720 mayperform step query by ZIP+4 738. Step query by ZIP+4 738 may query atest group and a control group from healthcare database 724 by usingcorrelating information from ad-outcome and consumer database 714. Thiscorrelating information may include address information or identifyinginformation such as a postal address or an online identifier. Forexample, the correlating information may be a ZIP+4 postal code. Whenusing a ZIP+4 postal code, the information obtained from healthcaredatabase 724 may not always precisely or accurately correspond to theindividual who viewed the advertisement and whose data may be stored inad-outcome and consumer database 714. Precise or high correspondencebetween healthcare database 724 and ad-outcome and consumer database 714may not be required to measure the effectiveness of an onlineadvertising campaign, because measuring the effectiveness of an onlineadvertising campaign may occur, to a measurable degree of statisticalcertainty, without a direct correspondence between the individual whosedata is represented in healthcare database 724 and ad-outcome andconsumer database 714. In other words, it may be sufficient to know thata quantity of consumers within a geographic area have consumed theonline advertising without knowing which individuals have consumed thetreatment. In addition, this may help to maintain the privacy of theindividuals who may be suffering from the health condition or receivingmedical treatment, or who otherwise have protected healthcareinformation. Step query by ZIP+4 738 may write test group or controlgroup information to ZIP+4 and treatments database 740. Zip+4 andtreatments database 740 may include treatment results, which may be fora single treatment of a single patient, or which may tabulated among allpatients within a geographical location such as a ZIP+4 postal code.Treatments database 740 may relate to treatment results to a Zip+4postal code, a portion of a postal address, or an online identifier.

Step correlate by ZIP+4 742 may be performed by consumer-data entity704. Step correlate by ZIP+4 742 may include information from the ZIP+4and diagnosis database 740, ad-outcome and consumer database 732, andopt-in health info database 741. Opt-in health info database 741 mayinclude information about a consumer's health from non-governmentallyregulated sources such as online surveys that consumers may complete(through websites, email, or other electronic means) in response toadvertisements, sweepstakes, or social networking. Opt-in health infodatabase 741 may include information from membership organizations, suchas the American Association of Retired People (“AARP”), which collect“opt-in” information from their membership. Opt-in health info database741 may include information gathered from other non-governmentallyregulated sources. Consumer-data entity 704 may use opt-in health infodatabase 741 as an additional source for healthcare ailments andconditions, treatments, treatment results, and other healthcareinformation. Step correlate by ZIP+4 742 may also use both opt-in healthinfo database 741 and ZIP+4 and treatments database 740 to assistmeasuring the effectiveness of the online advertising campaign byquantifying or summarizing the treatment results available in bothdatabases. Step correlate by ZIP+4 742 may combine the treatment resultinformation with the ad-outcome and consumer database 732 to providedata to ad-outcomes and diagnosis database 743.

System 737 may measure the effectiveness of the online advertisingcampaign during step measure effects 736. Step measure effect 736 mayoccur substantially as described above in connection with FIG. 9C. Stepmeasure effect 736 may use data from ad-outcomes and diagnosis database743. In various embodiments, different sources of healthcare informationmay be quantified or summarized. In some embodiments, treatmentinformation (such as number of new patients, or the quantity ofdiagnosis) may be used. In other embodiments, diagnosis information(such as number of prescriptions or number of days of therapy) may beused. In still further embodiments, a combination of treatment anddiagnosis information may be used.

FIG. 10A shows a class diagram illustrating the relationships amonghealthcare database objects, consumer database objects, onlineadvertising database objects, and other example objects, according to anembodiment.

System 900 shows objects and their relationships to each other, as shownin FIG. 10A. Object consumer household 902 shows some example attributesthat may be stored for consumer household information on behalf of aconsumer-data entity. Object consumer household 902 may be similar toobject consumer household 402 (see FIG. 4 ). Object consumer household902 may include one or more online identifiers, such as Internetprotocol address or e-mail address. Object consumer household 902 mayinclude information related to a postal address, geographic location,phone number, Social Security number, or other information that may behelpful to identify the consumer. Object consumer household 902 mayinclude information from consumer household databases. Object consumerhousehold 902 may include information obtained from an “opt-in” orredemption process during the display of the online advertising. Objectconsumer household 902 may include information from commercial IPaddress databases that may be collected during other online activitiesor licensed/sold for use in targeting IP addresses.

Object healthcare 904 may be related to object consumer household 902through object keys and tokens 906. Object healthcare 904 may correlatewith keys and tokens 906 using similar attributes, information,relationships, and steps as described herein in connection with FIG. 4 ,including object consumer-household 402, object healthcare 404, andobject keys-and-tokens 406. Object healthcare 904 may include treatmentinformation, such as a new diagnosis, a new patient, number of pillsused, number of prescriptions written, number of days of therapy, otherprescription information, medical billing information, and otherinformation that is related to the treatment or diagnosis of an illnessor ailment. In some embodiments, object healthcare 904 may includedetailed disease and treatment information on more than 100 millionpatients, which may be grouped into more than 35 million Zip+4 areas.Object consumer household 902 may include information that is notregulated as personal healthcare information. In some embodiments,object consumer household 902 may include detailed address informationon as many households as possible; for example, using data from morethan 150 million Internet-enabled device. The detailed addressinformation may include IP addresses, email address, and postal ormailing addresses. In some embodiments, object consumer household 902may include information supplied from the online advertising entity oronline advertising webserver such as information captured during aredemption. In some embodiments, healthcare data may be sub-setted toinclude a statistically significant portion of healthcare datacorrelated to the set of keys, whereby a subset of healthcare data isformed. In some embodiments, healthcare data may include some falsifieddata that represents a statistically insignificant portion of thehealthcare data.

In embodiments that calculate the effectiveness of online advertising,the object model may relate information associated with the outcome ofan advertisement display to treatment information available inhealthcare database. In FIG. 10A, object ad-outcomes 908 may beassociated with object keys-and-treatments 910 through objectad-outcomes and treatments 912.

Object ad-outcomes 908 may be correlated with object consumer household902 using information gathered during the display of the onlineadvertisement, such as the IP address where the advertisement wasdisplayed, the e-mail address where the advertisement was sent, or otheronline identifier used to deliver the advertisement to a potentialconsumer. Object ad-outcomes 908 may include other information collectedat the time the advertisement was displayed, such as whether theconsumer clicked a link in the advertisement, whether the consumerfollowed the advertisement to redeem, what time and date the ad wasdisplayed, which advertisement was displayed to the potential consumer,what website the consumer was viewing when the advertisement wasdisplayed, how long the advertisement was displayed, and any othermetrics that may be gathered by an online advertising entity. Objectad-outcomes 908 may include an outcome-indicator to indicate the outcomeof the online advertising, for example user clicked ad, user exposed toad, user redeemed ad, or user viewed other websites with healthinformation. This may allow the system to divide the set of healthcaredata into at least four groups including a group that viewed, a groupthat clicked, a group that redeemed, and a group not exposed to onlineadvertising. In other embodiments, other groupings may be used.

Object keys-and-treatments 910 may be extracted from object health care904 using the ailment or health condition that the online advertisementendeavors to relieve or alleviate. Object keys-and-treatments 910 mayinclude a key from the process of de-identifying the data in objecthealth care 904. The key may be derived from the same process used todetermine the key for the key of object keys-and-tokens 906. This mayallow treatment information to be later related to informationassociated with the display of the online advertisement. Objectkeys-and-treatments 910 may include information related to treatment,such as whether or how many new diagnosis, new prescription information,refill prescription information, the date of treatment, number ofdisplay ad exposures, number of clicks, number of redemptions, number ofprescriptions with a Zip+4 that received an ad exposure, monthly countsof new prescriptions and/or total prescriptions, grouping by time period(monthly, weekly, daily, before, or after), measure by brand percentageof market share. Object ad-outcomes and treatments 912 may includeinformation needed to calculate the change in prescription volume andmarket share before and after the online advertising campaign within agroup that is presently being treated for the health condition which isthe subject of the online advertising. Object ad-outcomes and treatments912 may include information needed to calculate the change inprescription volume and share within a group that is presently beingtreated for the health condition which is the subject of the onlineadvertising. Object ad-outcomes and treatments 912 may allow forcomparison to a control group of Zip+4's for the three groupings:exposed, clicked, and converted.

FIG. 10B shows a class diagram illustrating the relationships amonghealthcare database objects, consumer database objects, onlineadvertising database objects, and other example objects, according to anembodiment. System 913 shows objects and their relationships to eachother. Object consumer household 914 shows example attributes that maybe stored for consumer household information on behalf of the consumerdata entity. Object consumer household 914 may include informationrelated to online identifiers used by the consumer such as theconsumer's IP addresses, the consumer's e-mail addresses, the consumer'sweb browser cookie information, and other information that may be usedto identify the consumer online. In some embodiments, geographicalindicator may be stored within, or embodied within an online identifier.For example, a ZIP+4 postal code may be placed within a web browsercookie. Object consumer household 914 may include information related tothe geographic location of the consumer, such as the postal address, theZIP+4 postal code, a portion of the postal address, latitude andlongitude, and other information that may identify the geographicallocation of the consumer.

Object consumer household 914 may be related to object health care 904by querying using geographically identifying information such as a ZIP+4postal code. Object consumer household 914 may be related to objectad-outcomes 908 by correlating an online identifier from objectad-outcomes 908 to an online identifier in object consumer household914.

Object ZIP+4 and treatments (not shown) may store a geographicidentifier in connection with a treatment result for a consumer. ObjectZIP+4 and treatments may store tabulated summary treatment results forconsumers located at or within the geographic identifier. For example,object zip+4 and treatments may include a geographic identifier such asa ZIP+4 postal code, a postal address, or a portion of a postal address.Object ZIP+4 and treatment may include treatment results, including thetreatment date or advertising period. Object ZIP+4 and diagnosis 916 mayinclude tabulations, summarizations or amounts of patients, newdiagnosis, prescriptions, or other quantification of diagnosis results.Objects ZIP+4 and diagnosis 916 may include information relating todiagnosis, results, and geographical identifier to a particular testgroup or control group or other grouping of treatment information thatis useful to assist in the measurement of the effectiveness of theadvertising campaign. Objects ZIP+4 and diagnosis 916 may be related toobject healthcare 904 by querying or tabulating information in objecthealth care 904.

Object ad-outcomes and diagnosis 918 shows example attributes thatassist in the three-way correlation between the ad outcomes, theconsumer household information, and the treatment results. Objectad-outcomes and diagnosis 918 may include attributes to identify theconsumer, such as the online identifier, geographic identifier, or ZIP+4postal code. Object ad-outcomes and diagnosis 918 may include attributesto quantify, summarize, or tabulate the treatment results. Objectad-outcomes and diagnosis 918 may include attributes to indicate theadvertisement, ad campaign, or the ad outcome

FIGS. 11A-11C show a data structure layout diagram illustrating examplevalues of electronic lists for tracking information helpful indetermining or measuring the outcome of a healthcare advertisement,according to an embodiment.

FIG. 11A shows a data structure layout for evaluating ad-outcomes interms of diagnosis and treatments. Column Period indicates two or moredifferent time periods, for example before and after exposure to theonline advertising campaign. Column IP indicates the IP address of thedevice or computer connected to the Internet. Column IP may not have IPaddresses or other online identifiers for the control group because thecontrol group, by definition, likely did not see, did not respond, orwas not tracked by the online advertising campaign. Column Ad indicatesthe online advertising campaign. Column Test or Control indicates thegrouping of consumers, that is consumers who were exposed to the onlineadvertising campaign as the test group or consumers who were not exposedthe online advertising campaign. Columns New Patients, RXs, and AWP aresummaries or tabulations of diagnosis or treatment results for the givenperiod, IP address, ad campaign, and test or control group. Note thatthe example data and quantities are illustrative only and areintentionally simple to aid in understanding the calculation ormeasurement of the effectiveness of online advertising. Said anotherway, the diagnosis or treatment result values shown in the figure maynot be indicative of actual treatment results.

FIG. 11B shows a data structure layout to calculate a return oninvestment value for the data contained in FIG. 11A. Column Impressionsindicate the number of times an advertisement was displayed. Column Costper Impression indicates the cost to display or the average cost todisplay an impression. Column Test/control Difference shows thedifference between the average wholesale price (“AWP”) of the treatmentsfor the test group and the control group for each period. Column ROIshows the revenue increase attributable to online advertising as apercentage of the cost of the online advertising.

FIG. 11C shows a data structure layout to measure the effectiveness ofone online advertising campaign relative to another online advertisingcampaign using the values of FIG. 11A. Column Ad indicates the onlineadvertising campaign. Column Impressions indicates the number ofadvertisements that were displayed during the ad campaign. Column RXsindicates the treatment result as a quantity of prescriptionsattributable to the online ad impressions for the related ad campaign.Column RXs/Impressions shows how many prescriptions are attributable toeach impression.

Upon reading the teachings of this specification, those of ordinaryskill in the art will realize that other methods of calculation may beselected that allow comparison between online advertising campaigns,offline advertising campaigns, mixes of media, advertising messages,targeting profiles, and other advertising techniques, by using diagnosisor treatment results and considering such factors as online media type,consumer preferences, economic considerations, advances in advertisingtracking technology, advances in advertising display technology, andother factors.

FIG. 12 shows a network architecture diagram illustrating computersystem 619 configured to determine the effectiveness of onlineadvertising, according to an embodiment. Computer system 619 may besimilar to system 600. Computer systems 619 may include onlineadvertising entity 618. Online advertising entity 624 may storead-outcome data on ad outcome database 622. Online advertising entity624 and may include security measures 620. Although this diagram showsoperation of databases by three separate entities, in other embodiments,databases may be operated by a single entity or by more than threeentities, which may depend on factors such as economic considerations,efficiency considerations, governmental regulations of the data or dataholder, or requirements of third parties.

Although this specification describes the inventor's best mode and otherembodiments, it will be understood that the broadest scope of thedisclosed embodiments includes such modifications as diverse applicationof technology, variance of method steps, choice of softwarearchitecture, selection of targeting message methods, varying businessmethods, varying statistical methods, and other method steps. Such scopeis limited only by the below claims as read in connection with the abovespecification. Further, many other advantages will be apparent to thoseskilled in the art from the detailed descriptions and the claims.

What is claimed is:
 1. A computerized method having practical use inimproved targeting of advertisement messages for display on consumerdevices, which improved targeting utilizes non-personalized geographichealthcare condition data, the method comprising: with a programmedcomputer system including at least one processor and at least onememory: (a) for each of a plurality of geographic identifiers, eachgeographic identifier denoting a respective one of a plurality ofgeographic areas, producing targeting data by: (i) using a combinationdataset containing personal health data from a first database andpersonal consumer data from a second database, wherein: (A) the personalhealth data from the first database and the personal consumer data fromthe second database have been combined by use of a set of individualkeys, each key identifying one of a multitude of persons; (B) thepersonal health data from the first database associates the individualkeys with one of a set of healthcare condition codes, wherein each ofthe healthcare condition codes uniquely represents one of a plurality ofhealthcare conditions of interest, thereby indicating which of thepersons identified by the individual keys has which of the healthcareconditions of interest, and (C) the personal consumer data from thesecond database associates the individual keys with the geographicidentifiers, thereby which of the persons identified by the individualkeys resides in which of the geographic areas; and (ii) linking thegeographic identifier with a set of aggregate numerical values,determined using the combination dataset, wherein respective of theaggregate numerical values are based on the number of persons, in thegeographic area denoted by the geographic identifier, who are associatedwith respective of the healthcare condition codes, whereby each of theset of aggregate numerical values represents prevalence in thegeographic area of respective healthcare conditions of interestassociated with the respective healthcare condition codes; (iii) whereinthe targeting data does not contain personally identifiable information(PII) from the first database or the second database; and (b) removingfrom the targeting data information pertaining to those geographic areasand specific healthcare condition codes that would permitre-identification of persons in the geographic area associated withrespective of the healthcare condition codes; and (c) after part (b),using the targeting data to cause direction of an advertisement messagefor display on a plurality of consumer devices associated with each of aplurality of the geographic areas, based on prevalence in each of theplurality of geographic areas of one of the plurality of healthcareconditions of interest, which prevalence is based on the targeting data.2. The method of claim 1 wherein the removed targeting data that wouldpermit re-identification in part (a)(iii) comprises data related to anygeographic area containing only one person.
 3. The method of claim 1wherein the removed targeting data that would permit re-identificationin part (a)(iii) comprises data related to any geographic area in whichall of the individual keys associated with the identifier for thegeographic area are associated with at least one of the healthcarecondition codes, thereby indicating that all of the persons identifiedby the individual keys in the geographic area have the healthcarecondition.
 4. The method of claim 1 wherein the consumer data from thesecond database associates the individual keys with the geographicidentifiers based on IP addresses of consumer devices connected to theindividual keys.
 5. The method of claim 1 further comprising receiving,from a third-party entity, a certification that the process implementedby the computer system is in compliance with privacy regulations.
 6. Themethod of claim 1 wherein the geographic areas are areas identified bynine-digit Zip+4 (Zone Improvement Program plus four digits) codes. 7.The method of claim 1 wherein the geographic areas are city blocks. 8.The method of claim 1 wherein the geographic areas are multi-unitbuildings.
 9. The method of claim 1 wherein the personal health datafrom the first database is known to contain some falsified data records,but the programmed computer system does not have access to dataindicating which records of the first database are the falsified datarecords.
 10. The method of claim 1 wherein the aggregate numericalvalues are percentages.
 11. A computer system connected and programmedfor improved targeting of advertisement messages for display on consumerdevices, which improved targeting utilizes non-personalized geographichealthcare condition data, the computer system programmed to: (a) foreach of a plurality of geographic identifiers, each geographicidentifier denoting a respective one of a plurality of geographic areas,produce targeting data by: (i) using a combination dataset containingpersonal health data from a first database and personal consumer datafrom a second database, wherein: (A) the personal health data from thefirst database and the personal consumer data from the second databasehave been combined by use of a set of individual keys, each keyidentifying one of a multitude of persons; (B) the personal health datafrom the first database associates the individual keys with one of a setof healthcare condition codes, wherein each of the healthcare conditioncodes uniquely represents one of a plurality of healthcare conditions ofinterest, thereby indicating which of the persons identified by theindividual keys has which of the healthcare conditions of interest, and(C) the personal consumer data from the second database associates theindividual keys with the geographic identifiers, thereby indicatingwhich of the persons identified by the individual keys resides in whichof the geographic areas; and (ii) linking the geographic identifier witha set of aggregate numerical values, determined using the combinationdataset, wherein respective of the aggregate numerical values are basedon the number of persons, in the geographic area denoted by thegeographic identifier, who are associated with respective of thehealthcare condition codes, whereby each of the set of aggregatenumerical values represents prevalence in the geographic area ofrespective healthcare conditions of interest associated with therespective healthcare condition codes; (iii) wherein the targeting datadoes not contain personally identifiable information (PII) from thefirst database or the second database; and (b) remove from the targetingdata information pertaining to those geographic areas and specifichealthcare condition codes that would permit re-identification ofpersons in the geographic area associated with respective of thehealthcare condition codes; and (c) after part (b), use the targetingdata to cause direction of an advertisement message for display on aplurality of consumer devices associated with each of a plurality of thegeographic areas, based on prevalence in each of the plurality ofgeographic areas of one of the plurality of healthcare conditions ofinterest, which prevalence is based on the targeting data.
 12. Thecomputer system of claim 11 wherein the removed targeting data thatwould permit re-identification in part (a)(iii) comprises data relatedto any geographic area containing only one person.
 13. The computersystem of claim 11 wherein the removed targeting data that would permitre-identification in part (a)(iii) comprises data related to anygeographic area in which all of the individual keys associated with thegeographic identifier for the geographic area are associated with atleast one of the healthcare condition codes, thereby indicating that allof the persons identified by the individual keys in the geographic areahave the healthcare condition.
 14. The computer system of claim 11wherein the consumer data from the second database associates theindividual keys with the geographic identifiers based on IP addresses ofconsumer devices connected to the individual keys.
 15. The computersystem of claim 11 wherein the geographic areas are areas identified bynine-digit Zip+4 (Zone Improvement Program plus four digits) codes. 16.The computer system of claim 11 wherein the personal health data fromthe first database is known to contain some falsified data records, butthe programmed computer system does not have access to data indicatingwhich records of the first database are the falsified data records.